Google Cloud / Mandiant (GTIG)
mandiant-gtig · B · active
https://cloud.google.com/blog/topics/threat-intelligence
Google Threat Intelligence Group; absorbed Mandiant CTI. The /topics/threat-intelligence landing lists titles but NO publication dates (only relative read times). Drill rule: open the top 3-5 posts on the listing and read their date inline rather than treating the dateless landing as empty. RSS at https://cloud.google.com/blog/topics/threat-intelligence/rss is a partial mirror (truncated). (v2.55: rss_url verified, use `python3 tools/fetch_source.py feed https://feeds.feedburner.com/threatintelligence/pvexyqv7v0v [N]`) | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → feed https://feeds.feedburner.com/threatintelligence/pvexyqv7v0v 5 (dated listing) then webfetch the per-article cloud.google.com URL for the body; the HTML landing also works for titles but carries no dates. AVOID: The /topics/threat-intelligence HTML landing has titles but NO publication dates (only relative read-times), use the feedburner RSS for dates rather than treating the dateless landing as the index. The cloud.google.com/.../rss mirror is truncated.. | 2026-07-05 admiralty audit: B, GTIG/Mandiant original first-hand threat research. Reliability HIGH->B, status stays active. Use feedburner RSS for dates (HTML landing is dateless). | 2026-11-01 (2026-11-01T0256Z-intel): the FeedBurner feed lags and omits posts (nothing after 2026-10-15; it missed the 2026-10-31 ARTEX and Friends post). Working recipe: WebFetch the landing page https://cloud.google.com/blog/topics/threat-intelligence for titles, then `extract <post-url>`; the extract metadata date carries the publication date. | 2026-11-01 (2026-11-01T1312Z-audit): G3: the FeedBurner feed still lags (newest 2026-10-15 while GTIG posted on 2026-10-31); WebFetch of https://cloud.google.com/blog/topics/threat-intelligence gives titles and hrefs, and `extract <post>` gives the date.
Cited in 23 entries
Citation cadence
Citation days per ISO week (24 weeks of coverage span, total 19).
- ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration2026-10-22
- AOMEI Backupper and AnyViewer update files tampered with for five to ten minutes at a time between April and July 2026 to push the CROSSROAD downloader and the SHINYROAD backdoor, with Switzerland among 11 countries GTIG names2026-10-17
- CVE-2026-102764, BeyondTrust Remote Support: an unauthenticated file-operation flaw exploited as a zero-day since late August by a suspected China-nexus actor that left a web shell and boot-time sudo persistence (CVSS 4.0 9.3)2026-10-16
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- ANNUAL REPORT: Mandiant AI Risk and Resilience Report 2026: eight frontline case studies of AI-related attacks, failures and assessments2026-09-17
- Unit 42 exposes two Latin American intrusion clusters after their own AI-agent staging infrastructure was left open, one hit Mexican federal ministries and water utilities, the other Brazilian finance2026-09-04
- GTIG Agentic Vulnerability Discovery Harness (AVDH): Mandiant's multi-agent pipeline found 100+ true-positive critical vulnerabilities in a stolen corporate source-code repository within two days2026-08-28
- A hijacked crates.io account added the first dependency arrayref has taken in ten years, and that dependency ran a backdoor at compile time; every machine that built an affected project during a ninety-minute window must be treated as compromised2026-08-23
- Three Russia-nexus espionage clusters compromise European diplomats and academics without malware, by talking targets through app passwords, device-code approvals and WhatsApp device-linking, all of which are legitimate features working as designed2026-08-23
- UNC6671 kept operating after BlackFile's announced retirement, across four further extortion brands, and its vishing pretext is now an urgent order to enroll a FIDO2 passkey2026-08-07
- Mandiant "Ghost in the Database": recovering an active ADFS token-signing key from Machine DPAPI when the WID/DKM Golden SAML path fails2026-07-09
- Turla's STOCKSTAY: a four-component .NET backdoor for diplomatic intelligence collection2026-06-27
- Krebs and Qurium tie the "Popa" Android-TV residential-proxy botnet to a NASDAQ-listed proxy vendor2026-06-21
- PRC UNC6508 ran year-plus espionage through internet-facing REDCap servers and a Google Workspace BCC rule2026-06-16
- ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltration2026-06-11
- Unit 42: Microsoft Teams external-chat now a primary phishing surface for APT29 and UNC66922026-06-09
- Luna Moth / Silent Ransom Group (UNC3753): vishing-to-physical-access data-theft extortion against legal and professional services2026-06-06
- CVE-2026-20245: Cisco Catalyst SD-WAN netadmin-to-root command injection exploited as a zero-day; fixed releases and a Live Protect shield available2026-06-06
- Google's threat-intel group maps a Chinese-language PhaaS ecosystem doing real-time OTP relay over RCS/iMessage2026-05-26
- CVE-2026-5426, Digital Knowledge KnowledgeDeliver LMS: pre-shared ASP.NET machineKey enables ViewState deserialization RCE, exploited as a zero-day2026-05-26
- GTIG: UNC6671 "BlackFile" vishing → AiTM → rogue-MFA → programmatic SharePoint exfiltration (1M+ files from one victim); DLS shutdown signals possible rebrand2026-05-16
- Checkmarx Jenkins AST plugin backdoored: rogue build 2026.5.09 swept build hosts for credentials on 2026-05-09/10, the third wave of malicious Checkmarx artifacts since March (TeamPCP claimed)2026-05-12
- GTIG AI Threat Tracker (May 2026): an AI-developed zero-day 2FA bypass prepared for mass exploitation, AI decoy code in Russia-nexus malware and PROMPTSPY's Gemini agent2026-05-12